PT-2025-30427 · Unknown · Chatplayground.Ai

Name of the Vulnerable Software and Affected Versions: ChatPlayground.ai versions through 2025-05-24 Description: A self Cross-Site Scripting XSS issue exists that allows attackers to execute arbitrary code and gain sensitive information via a crafted SVG file contents sent through the chat...

PT-2025-30428 · Chaindesk · Chaindesk

Name of the Vulnerable Software and Affected Versions: Chaindesk versions through 2025-05-26 Description: A stored Cross-Site Scripting XSS vulnerability exists in the agent chat component. An attacker can execute arbitrary client-side scripts by creating an AI agent with a system prompt designed...

PT-2025-30490

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 141 Thunderbird versions prior to 141 Description The software incorrectly truncated URLs towards the beginning instead of around the origin. Recommendations Update Firefox to version 141 or later. Update Thunderbird ...

PT-2025-30416 · Hotelrunner · Hotelrunner B2B

Name of the Vulnerable Software and Affected Versions: HotelRunner B2B versions prior to 04.06.2025 Description: This issue allows for Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of input during web page generation. Recommendations: Update HotelRunner B2B to...

WordPress Caliris Theme <= 1.5 is vulnerable to Local File Inclusion

Software Caliris Type Theme Vulnerable versions = 1.5 Fixed in 1.6 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48160 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 97a9204ac041 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

PT-2025-30447 · Duracomm · Duracomm Dp-10In-100-Mu +1

Name of the Vulnerable Software and Affected Versions: DuraComm SPM-500 DP-10iN-100-MU DuraComm DP-10iN-100-MU Description: The software is susceptible to a cross-site scripting attack, potentially preventing legitimate users from accessing the web interface. Recommendations: At the moment, there...

PT-2025-30395 · Typo3 · Femanager

Name of the Vulnerable Software and Affected Versions: femanager versions 6.4.1 and below femanager versions 7.0.0 through 7.5.2 femanager versions 8.0.0 through 8.3.0 Description: The femanager extension for TYPO3 contains an Insecure Direct Object Reference issue, which allows unauthorized...

PT-2025-30451 · Alertenterprise · Alertenterprise Guardian

Name of the Vulnerable Software and Affected Versions: AlertEnterprise Guardian version 4.1.14.2.2.1 Description: An issue allows bypassing manager approval by modifying the user ID in a Request Building Access requestSubmit API call. Recommendations: Apply changes to the Request Building Access...

PT-2025-30499 · Poly · Poly Clariti Manager

Name of the Vulnerable Software and Affected Versions: Poly Clariti Manager versions prior to 10.12.1 Description: A security issue has been identified in Poly Clariti Manager that may allow the use and retrieval of the default password. Recommendations: Update Poly Clariti Manager to version...

PT-2025-30478

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 141 Thunderbird versions prior to 128.13 Firefox versions prior to 141 Firefox ESR versions prior to 128.13 Firefox ESR versions prior to 140.1 Description Thunderbird and Firefox are affected by a flaw where...

WordPress Extensions For CF7 plugin <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion vulnerability

Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Extensions For CF7 versions = 3.2.8...

CVE-2025-54128 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy CSP. This configuration is insecure for a production application because it does not protect against...

CVE-2025-53528 Cadwyn is vulnerable to an XSS attack through its docs page

Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS Cross-Site Scripting attack. This XSS would notably allow an attacker to execute JavaScript code ...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2024-56339)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

OSV-2025-564 Heap-buffer-overflow in ndpi_match_host_subprotocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=432880859 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpimatchhostsubprotocol checkcontenttypeandchangeprotocol processrequest...

Adobe Substance3D Viewer Null Pointer Dereference Vulnerability

Adobe Substance3D Viewer is a stand-alone desktop application for viewing and editing 3D files from Audobee Adobe USA. Adobe Substance3D Viewer suffers from a null pointer dereference vulnerability that can be exploited by attackers to cause a denial of service in the application...

PT-2025-30276 · Pavo Pay · Pavo Pay

Name of the Vulnerable Software and Affected Versions: PAVO Pay versions prior to 13.05.2025 Description: A use of hard-coded credentials issue exists in PAVO Pay, allowing the reading of sensitive constants within an executable. Recommendations: Update PAVO Pay to version 13.05.2025 or later...

IBM Cognos Analytics Mobile 安全漏洞

IBM Cognos Analytics Mobile is an application from International Business Machines IBM, Inc. Integrates reporting, modeling, analytics, dashboards, cases, and event management. A security vulnerability exists in IBM Cognos Analytics Mobile versions 1.1.0 through 1.1.22, which stems from the use o...

PT-2025-30348 · Unknown · Haxcms-Nodejs

Name of the Vulnerable Software and Affected Versions: HAX CMS NodeJs versions 11.0.8 and below Description: HAX CMS NodeJs, a system for managing microsite universes with a NodeJs backend, is susceptible to a crash issue. An authenticated attacker can trigger this issue by sending API requests t...

PT-2025-30343

Name of the Vulnerable Software and Affected Versions Manager-io/Manager versions up to and including 25.7.18.2519 Description Manager-io/Manager is accounting software with a critical unauthenticated Server-Side Request Forgery SSRF vulnerability identified in the proxy handler component. This...